Gathered during the Cenzic Managed Security team’s analysis of applications in production, the report
reveals the massive number of vulnerabilities prevalent in web and mobile applications today. The report
highlights the type, frequency and severity of vulnerabilities found and predicts which vulnerabilities
will pose the greatest risk in web and mobile applications in production throughout 2013.

“Securing the application layer must be addressed more realistically by today’s businesses,” said Scott
Parcel, chief technology officer at Cenzic. “The exposure that organizations face from the trove of existing
application vulnerabilities and from evolving threats has been laid bare this year, however most organizations
have not comprehensively acted to defend themselves from these application level threats. This trend
continues to get worse; as the rush to create a multitude of connected mobile apps has led corporations
to essentially rip out walls and replace them with unlocked doors, leaving them even less aware of how
to secure at scale.”

The report also includes a study of mobile security threats, focusing on how data is transferred to
and stored on mobile devices. According to Cenzic’s findings, Input Validation (21 percent), Session
Management (11 percent) and Privacy Violation (25 percent) combine to account for 57 percent of mobile
vulnerabilities. These results suggest that while storing unencrypted sensitive data on sometimes-lost
mobile devices is a significant cause for concern, the often-unsecured web services commonly associated
with mobile applications can pose an even bigger risk.

“Businesses are moving into the mobile space for more and more activities—both for their internal and
customer-facing applications,” continued Bala Venkat, chief marketing officer at Cenzic. “As the mobile
space continues to evolve, we are seeing that for all the fear over malware and bots, much of the risk
still resides in back-end server communication. Locking down this connection is the key to protecting
not just an individual’s sensitive information, but that of an entire organization.”

Cenzic provides the leading application security intelligence platform to continuously assess Cloud,
Mobile and Web applications to reduce online security risk. Cenzic’s solutions scale from single applications
to enterprise-level deployments with hybrid approaches that enable testing of applications at optimal
levels. Cenzic helps brands of all sizes protect their reputation and manage security risk in the face
of malicious attacks. Cenzic's solutions are used in all parts of the software development lifecycle,
and most importantly in production, to protect against new threats even after the application has been
deployed. Cenzic's application security intelligence platform is architected to handle web, cloud
and mobile applications and is the first to provide risk reduction recommendations for business, application
developers and specific applications. Today, Cenzic secures more than half a million online applications
and trillions of dollars of commerce for Fortune 1000 companies, all major security companies, government
agencies, universities and SMBs. More information about Cenzic can be found at
www.cenzic.com.